CVE-2014-0148
qemu: Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when...
CVE-2014-0148 is fixed in qemu on 1 platform, first by DEBIAN-CVE-2014-0148, released September 29, 2022. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
5.5
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0030
23rd percentile
Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| qemu · Debian 12.15 (bookworm) | 2.0.0+dfsg-1 | DEBIAN-CVE-2014-0148 | Sep 29, 2022 |
| qemu · Debian 13.5 (trixie) | 2.0.0+dfsg-1 | DEBIAN-CVE-2014-0148 | Sep 29, 2022 |
| qemu · Debian 14 | 2.0.0+dfsg-1 | DEBIAN-CVE-2014-0148 | Sep 29, 2022 |